Performance analysis of DoS attack at MAC layer in WLAN / Muhammad Naufal Abdul Rahim and Ahmad Yusri Dak

• Main Authors: Abdul Rahim, Muhammad Naufal, Dak, Ahmad Yusri
• Format: Book Section
• Language: English
• Published: College of Computing, Informatics and Media, UiTM Perlis 2023
• Subjects: Intrusion detection systems (Computer security). Computer network security. Hackers
• Online Access: https://ir.uitm.edu.my/id/eprint/100813/1/100813.pdf; https://ir.uitm.edu.my/id/eprint/100813/
• Institution: Universiti Teknologi Mara

Wireless LAN are based on the most widely used computer networks, the IEEE 802.11 standards – commonly known as Wi-Fi. The MAC layer of IEEE 802.11 provides a protocol that specifies the set of media access control (MAC) and physical layer (PHY) protocols for implementing wireless local area network computer communication. In IEEE 802.11 protocol, many vulnerabilities are present at the MAC layer which give rise to a lot of Denial of Service (DoS) attacks. Furthermore, 802.11 standards use frames for communication between NICs and APs and for controlling and managing wireless links. The three main types of frames are data, control and management. Data frames are authenticated and encrypted but control and management frames are neither authenticated nor encrypted. So, they can be easily spoofed by the attacker to perform denial of service attacks. The goal of this article is to study various types of DoS attack at the MAC layer in WLAN and to evaluate the performance of the network using throughput and packet loss ratio (PLR). In addition, this project will be conducted in a real testbed environment with 3 different scenarios, each with a different type of layer 2 DoS attack. Finally, the result shows that deauthentication attack and ARP spoofing attack to be very successful as it manages to cripple the victim's connection to the AP or the internet. Both attacks result in a steep decline of packet loss and network throughput during the attack. On the other hand, the authentication flooding attack seems to show no result on the packet loss ratio and network throughput whatsoever. In conclusion, de-authentication and ARP spoofing attacks are very much capable of disrupting any WLAN network connection.